Industry-standard routing protocols that are used in AWS hybrid networks (for example, BGP over Direct Connect)

What is BGP and why is it important for AWS hybrid networks using Direct Connect?

BGP, or Border Gateway Protocol, is the standard routing protocol used to exchange routing information across the internet and between different networks. It’s important for AWS hybrid networks because when used with AWS Direct Connect, it allows for dynamic routing between an on-premises network and AWS VPCs, which can lead to more efficient use of network resources, improved redundancy, and increased network agility.

Can you explain the role of Autonomous System Numbers (ASNs) in BGP for AWS hybrid networks?

An ASN is a unique identifier used in BGP to identify each network on the internet. In AWS hybrid networks, the ASN allows AWS to distinguish among different customer networks. When setting up BGP over Direct Connect, customers can use either their private ASN or request a public ASN from AWS if they don’t have one.

How does BGP over AWS Direct Connect facilitate high availability in hybrid networks?

BGP facilitates high availability by enabling multiple redundant connections between on-premises networks and AWS. It uses its built-in protocol mechanisms to automatically reroute traffic if a link goes down, ensuring that the network remains available in the event of a failure.

What are some of the BGP attributes used in route selection that are relevant to AWS Direct Connect?

BGP attributes such as AS_PATH, LOCAL_PREF, WEIGHT, and MED (Multi-Exit Discriminator) are commonly used in route selection. These attributes help BGP to select the best path among multiple available paths, which is crucial for efficient and optimized routing over Direct Connect.

How do you configure BGP on an AWS Direct Connect gateway?

To configure BGP on an AWS Direct Connect gateway, you need to create a Virtual Interface (VIF) and then configure the BGP settings such as your peer IP, your BGP ASN, and MD5 authentication (if desired). After setting up the VIF, you would configure similar parameters on your on-premise router to match the AWS side and establish the BGP session.

In the context of AWS Direct Connect, what is the difference between a public VIF and a private VIF, and when would you use BGP with each?

A public VIF is used to access public AWS services, such as S3 or DynamoDB, over Direct Connect, while a private VIF is used to connect to private resources within a VPC, such as EC2 instances or RDS databases. BGP is used with both types of VIFs; with a public VIF, it exchanges routes pertaining to AWS public endpoints, and with a private VIF, it exchanges routes for the VPC CIDR blocks.

What is the purpose of BFD (Bidirectional Forwarding Detection) when used with BGP over AWS Direct Connect?

BFD is a network protocol used for rapid detection of failures in the forwarding path between two routers. When BFD is paired with BGP over AWS Direct Connect, it provides low-overhead, fast failure detection and aids in achieving quick failover to alternative routes, improving network resilience.

How does the concept of BGP route propagation work when integrating AWS Direct Connect with a VPC?

In AWS, BGP route propagation involves the automatic distribution of routes between a Direct Connect gateway and a VPC via a VIF. When enabled on a VPN connection or a Direct Connect gateway, it allows routes learned via BGP to be automatically propagated to the VPC route table, enabling seamless access to the on-premise resources.

What limitations should you be aware of when advertising routes over BGP with AWS Direct Connect?

AWS imposes a limit on the maximum number of routes (100 prefixes for private VIFs and 1,000 for public VIFs) that can be advertised over BGP to Direct Connect. Additionally, AWS also has requirements and best practices for BGP community tags and prefers customers to use route filtering to manage the advertised and received routes effectively.

How can you troubleshoot a failed BGP session over AWS Direct Connect?

Troubleshooting a failed BGP session involves checking the BGP configuration on both the AWS and on-premise sides, ensuring that the ASN, BGP peers, and MD5 authentication (if used) match. You should also verify that there are no underlying connectivity issues, the network Access Control Lists (ACLs) and security groups allow BGP traffic, and that the BGP timers are set appropriately for the expected hold time.

Describe how to secure BGP sessions on AWS Direct Connect.

BGP sessions on AWS Direct Connect can be secured by using MD5 authentication, which ensures that only trusted parties can establish a BGP session. Secondly, you can use BGP community tags to apply policies to route advertisements. Additionally, AWS recommends using BGP session timers to detect outages quicker, and access control mechanisms, to govern inbound and outbound traffic to the BGP routers.

Can you discuss the best practices for designing a resilient hybrid network with BGP and AWS Direct Connect?

Best practices include using redundant AWS Direct Connect connections at geographically diverse locations and configuring them in an active-active or active-passive manner. Leveraging BGP’s ability to perform route health checks and automatically failover to healthy routes is also recommended. Splitting your network traffic using multiple VIFs to isolate the traffic and potentially increase bandwidth management efficiency is another common practice.